Millions of Chrome Users Exposed to Search Hijacking Through 319 Extensions

Security researchers have uncovered 319 malicious Google Chrome extensions with a combined 13.4 million reported installations. The extensions hijack browser searches and redirect traffic through servers controlled by their operators to generate advertising revenue.

According to Socket security researcher John Tuckner, the extensions intercept users’ searches before redirecting them to Bing or Yahoo through proxy servers. This allows the operators to profit from search referral programs while potentially exposing users to additional security risks.

Malicious Chrome extensions disguised as legitimate tools

The extensions pose as legitimate browser utilities, including PDF converters, document finders, security tools, and AI-powered search assistants.

Many use Chrome’s built-in chrome_settings_overrides functionality to change the default search engine without requiring users to manually adjust their browser settings.

Although the extensions appeared on the Chrome Web Store, many were unlisted and reached users through suspicious online advertisements.

Researchers also warned that the operators can change search destinations remotely without updating the extensions. This creates a potential risk of redirecting users to phishing websites or pages distributing malware.

Two Chrome extension groups affected millions of users

Socket identified several large clusters of malicious extensions, including Bing-Search and SecuryBrowse.

The Bing-Search group contained 37 extensions with approximately 2.2 million reported users. Researchers linked their promotion to advertisements distributed through Bidbrain.

The SecuryBrowse group included 58 extensions with approximately 4.9 million users. These extensions frequently used security-related names such as Fire Shield, Securify, and WatchTower to appear trustworthy.

Most of the identified extensions had already disappeared from the Chrome Web Store when Socket published its findings. However, researchers continue to discover new extensions associated with the campaign.

Chrome users should check their installed extensions

Users should review their installed Chrome extensions and compare them against Socket’s published list of suspicious extensions.

Anyone who finds a matching extension should remove it, check Chrome’s default search engine, and run a full antivirus scan.

Users should also avoid installing unnecessary extensions from unknown developers, even when they appear on the official Chrome Web Store.

In other security news, Google Chrome is testing a temporary option to turn off Safe Browsing protection, while Gemini AI scam detection and ClickFix protection aim to improve browser security.

Meanwhile, Chrome can now use details from Gmail to fill out forms with Gemini.

Via BleepingComputer